Re: [Nmlrg] Machine Learning in network - solicitation for use cases

["Dacheng Zhang" <[e-mail]>]

在 15-9-6 下午5:01， "Sheng Jiang" <[e-mail]> 写入:

>>Some more detailed introduction.
>>
>>DDoS and APT are very active research topics. Application layer DDoS
>>attacks are more difficult to detect than layer 4 DDoS attacks. In many
>>cases, the application layer DDoS does not introduce large amount
>>traffics. However, by using big data and data mining tech, it is possible
>>to find out the clues of such attacks.
>
>Hi, Dacheng,
>
>Applying machine learning in DDoS protection is an interest use case. For
>my understanding, the machine would learn the potential attack behaviors,
>am I right?

Yes， you are right.
>
>If yes, I have two questions: a) does the machine learning has the
>possibility to learn/identify new attack behaviors, which was not
>recognized before? If yes, what is the working principles?

Normally we need to generate a normal behavior model and some “abnormal
behavior models”, the machine will detect whether certain behavior of a
client will be located in an ‘abnormal’ area.
I need to check with my colleagues to see whether we could disclose more
detailed information for the moment.

> b) is it possible for autonomic reaction from the network operational
>perspective after detect such DDoS attack? Give the machine learning may
>not be accurate, my guess is human intervention is needed.

In the current practice, machine learning procedure is normally offline.
1) machine learning may not very that accurate. 2) big data processing
needs time and computing resources.  Human involvement is required.

Looking for future discussion on this topic.

Cheers

Dacheng

>
>Best regards,
>
>Sheng
>
>>There were some related discussions in Dots. If you are interested, I
>>could find them out later.
>>
>>_______________________________________________
>>nmlrg mailing list
>>[e-mail]
>>https://www.irtf.org/mailman/listinfo/nmlrg